Methods and apparatus for generic process chain entity mapping

Abstract

Methods, apparatus, systems and articles of manufacture are disclosed for generic process chain entity mapping. An example apparatus includes at least one memory, instructions in the apparatus, and processor circuitry to execute the instructions to receive process chain input data, the input data including a system path, identify a match between a path alias and the input data, wherein the path alias includes an alias for one or more system path format patterns, extract at least one of (1) metadata information or (2) command line parameter information from the match, and output transformed data based on the at least one of the extracted metadata information or command line parameter information, the transformed data output in a generalized format.

What is claimed is: 
     
       1. An apparatus to perform process chain entity mapping, the apparatus comprising:
 at least one memory; 
 instructions in the apparatus; and 
 processor circuitry to execute the instructions to:
 receive process chain input data, the input data including a system path; 
 identify a match between a path alias and the input data, wherein the path alias includes an alias for one or more system path format patterns; 
 extract at least one of (1) metadata information or (2) command line parameter information from the match; and 
 output transformed data based on the at least one of the metadata information or command line parameter information. 
 
 
     
     
       2. The apparatus of  claim 1 , wherein the process chain input data includes at least one of an executable file, a text file, or a Uniform Resource Locator (URL) file. 
     
     
       3. The apparatus of  claim 1 , wherein the processor circuitry is to identify the path alias using path alias mapping rules, the mapping rules based on empirical evidence obtained using field telemetry data. 
     
     
       4. The apparatus of  claim 1 , wherein the process circuitry is to prioritize select system path format patterns when identifying the match. 
     
     
       5. The apparatus of  claim 1 , wherein the metadata information includes at least one of a file reputation or a process extension. 
     
     
       6. The apparatus of  claim 1 , wherein the command line parameter information includes at least one of a registry key path or an internet protocol address. 
     
     
       7. The apparatus of  claim 1 , wherein the processor circuitry is to identify the process chain input data as clean or malicious based on the transformed data output. 
     
     
       8. The apparatus of  claim 1 , wherein the processor circuitry is to perform iterative mapping to discriminate future input data as clean or malicious. 
     
     
       9. The apparatus of  claim 1 , wherein the transformed data retains original entity characteristics to retain an original input signal associated with the input data. 
     
     
       10. A non-transitory computer readable storage medium comprising instructions which, when executed, cause at least one processor to at least:
 receive process chain input data, the input data including a system path; 
 identify a match between a path alias and the input data, wherein the path alias includes an alias for one or more system path format patterns; 
 extract at least one of (1) metadata information or (2) command line parameter information from the match; and 
 output transformed data based on the at least one of the metadata information or the command line parameter information. 
 
     
     
       11. The non-transitory computer readable storage medium of  claim 10 , wherein the instructions, when executed, cause the at least one processor to identify the path alias using path alias mapping rules, the mapping rules based on empirical evidence obtained using field telemetry data. 
     
     
       12. The non-transitory computer readable storage medium of  claim 10 , wherein the instructions, when executed, cause the at least one processor to prioritize select system path format patterns when identifying the match. 
     
     
       13. The non-transitory computer readable storage medium of  claim 10 , wherein the instructions, when executed, cause the at least one processor to identify the process chain input data as clean or malicious based on the transformed data output. 
     
     
       14. A method to perform process chain entity mapping, the method comprising:
 receiving, by executing an instruction with a processor, process chain input data, the input data including a system path; 
 identifying, by executing an instruction with a processor, a match between a path alias and the input data, wherein the path alias includes an alias for one or more system path format patterns; 
 extracting, by executing an instruction with a processor, at least one of (1) metadata information or (2) command line parameter information from the match; and 
 outputting, by executing an instruction with a processor, transformed data based on the at least one of the metadata information or the command line parameter information. 
 
     
     
       15. The method of  claim 14 , further including identifying, by executing an instruction with a processor, the path alias using path alias mapping rules, the mapping rules based on empirical evidence obtained using field telemetry data. 
     
     
       16. The method of  claim 14 , further including identifying, by executing an instruction with a processor, the process chain input data as clean or malicious based on the transformed data output. 
     
     
       17. The method of  claim 14 , further including performing, by executing an instruction with a processor, iterative mapping to discriminate future input data as clean or malicious. 
     
     
       18. An apparatus comprising:
 means for receiving process chain input data, the input data including a system path; 
 means for identifying a match between a path alias and the input data, wherein the path alias includes an alias for one or more system path format patterns; 
 means for extracting at least one of (1) metadata information or (2) command line parameter information from the match; and 
 means for outputting transformed data based on the metadata information or the command line parameter information. 
 
     
     
       19. The apparatus of  claim 18 , wherein the means for identifying includes identifying the path alias using path alias mapping rules, the mapping rules based on empirical evidence obtained using field telemetry data. 
     
     
       20. The apparatus of  claim 18 , wherein the means for extracting includes extracting at least one of a file reputation or a process extension.